Source-linked AI summary
OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
Karina Elzer, Niklas Netterstrøm Johansen, Emmanouil Vasilomanolakis
TL;DR
Real-world targeting of exposed, self-hosted LLM services remains poorly understood. Ollure, a low- and medium-interaction Ollama API honeypot, captured mostly automated reconnaissance alongside concrete exploitation attempts against infrastructure and LLM layers.
Problem
The paper examines threats targeting public-facing, unprotected LLM infrastructure amid reported exposure of self-hosted Ollama instances and vulnerabilities including missing authentication, SSRF, and path traversal.
Source: §1 · pp. 1–2Method
Results
Most activity was automated reconnaissance, fingerprinting, and model enumeration, but observed exploitation attempts also spanned infrastructure and LLM layers, including prompt injection and agent-oriented tool use.
Source: §5 · p. 20Takeaways & Limitations
Ollure and its pseudo-anonymized interaction dataset provide a basis for further measurement of real-world threats against self-hosted LLM infrastructure.
Source: §5 · p. 20Passive measurements of inference interactions with privately deployed, Internet-facing LLMs remain limited, so Ollure relied on initial observations and may need more advanced dynamic responses as requests evolve.
Source: §3.2 · p. 8
Abstract
from arXiv · showhide
Publicly exposed large language model (LLM) infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and university networks, Ollure operated for 84 days and recorded 290,887 interactions from 2,793 unique source IP addresses. Most of the activity consisted of automated discovery, fingerprinting, and model enumeration. However, we also observed concrete exploitation attempts against both the infrastructure and LLM layers. These included model management abuse, path traversal and SSRF probes, RCE and cryptocurrency mining payloads, resource exhaustion attempts, prompt injection, information extraction, and agent-oriented tool use. Our results provide empirical insight into real-world threats against exposed, self-hosted LLM services.
1 Introduction
Publicly exposed Ollama instances may lack authentication and contain vulnerabilities that enable data leakage, unauthorized resource use, or host compromise. Ollure is a low- and medium-interaction Ollama API honeypot designed to measure attacks on exposed LLM infrastructure.
1 Introduction
- Shodan reveals nearly 20k publicly exposed Ollama instances, while Xu et al. observed 152,137 cumulative endpoints over 362 days.Exposed instances may lack native authentication and face SSRF, authentication, and path-traversal vulnerabilities, risking data leakage, unauthorized resource use, or host compromise.Source: §1 · p. 1
- Honeypots lure attackers to decoy services and record their activity in a controlled environment, where any interaction is inherently suspicious.Cyber deception uses believable fake infrastructure to detect and analyze unauthorized activity.Source: §1 · pp. 1–2
- Prior work has focused on using LLMs to enhance decoy realism or deceive LLM attackers, while empirical LLM-honeypot measurement is only emerging.Yáñez and Tobón introduced HIVE-AI, a multi-service honeypot for a hardened multi-stage LLM threat-hunting pipeline.Source: §1 · p. 2
- Ollure is a low- and medium-interaction Ollama API honeypot that observes real-world attacks on exposed, unprotected LLM infrastructure.The authors deployed it for 84 days, made its code publicly available, and released a pseudo-anonymized dataset.Source: §1 · p. 2
- Ollure’s empirical analysis examines interaction traffic and attack attempts, including active exploitation of exposed LLM endpoints.The honeypot enables passive Internet measurements of adversary interest and sophistication.Source: §1 · p. 2
2 Background & Related Work
The background defines cyber deception and Ollama’s self-hosted API context, frames attacks against AI systems, and positions dedicated measurement of attacks on LLM APIs as an emerging gap.
2.1 Cyber deception
- Honeypots are decoy servers classified by interaction level: low-interaction systems emulate basic service skeletons, medium-interaction systems provide partial functionality, and high-interaction systems expose full functionality.Source: §2.1 · p. 2
2.2 Large Language Models
- Open-weight models support self-managed LLM deployment; Ollama manages local models, parameters, hardware, and interactions through REST endpoints for model information, management, and inference.Ollama also supports cloud-model proxying and OpenAI-compatible API paths.Source: §2.2 · p. 3
2.3 AI Security
- AI-system threats span infrastructure reconnaissance and exploitation through LLM-specific attacks, while agentic systems add external tool use and privilege delegation; this study maps infrastructure and model attacks, excluding training-time.Source: §2.3 · p. 3
- MITRE ATLAS provides a standardized AI-threat taxonomy, with tactics including reconnaissance, initial access, execution, and discovery.OWASP GenAI LLM Top 10 2026 highlights prompt injection, sensitive information disclosure, and excessive agency; Tamuka et al. categorize attacks on LLM agents.Source: §2.3 · p. 4
2.4 Related Work
- Prior honeypots either lacked LLM-endpoint coverage or focused on short, single-site defense validation; Ollure fills this gap with Ollama-specific emulation and extended passive measurement.HIVE-AI collected 16,682 attack requests from 1,229 unique IP addresses over 20 days, but its deployment validated a defensive pipeline rather than broadly mapping attacks.Source: §2.4 · p. 5
3 Honeypot Architecture
Ollure emulates the Ollama API without a backing LLM or execution engine, enabling safer observation of infrastructure- and LLM-level attacks. Its low-interaction version returns static API responses, while the medium-interaction version adds session tracking and context-sensitive behavior.
3 Honeypot Architecture
- Ollure provides low- and medium-interaction honeypots: the former returns static endpoint structures and responses, while the latter adds session tracking and flexible model-management and inference behavior.The architecture is designed to observe infrastructure- and AI-targeted attacks without a backend LLM or execution engine.Source: §3 · p. 6
3.1 API Core
- The API core returns believable Ollama response structures and errors; endpoints are unauthenticated on standard port 11434, consistent with Ollama’s lack of default authentication.Artificial delays approximate endpoint behavior, including 281–357 ms for initialization, 2.1–2.9 s for prompt evaluation, and an additional 52–54 s when loading an unloaded model.Source: §3.1 · pp. 6–7
3.2 Model Management & Model Inference
- The LIH ignores prior calls and uses a static available-model list, with model-management and inference requests returning static responses.The MIH instead tracks sessions by client IP and User-Agent, ending a session after 30 minutes without an API call; it stores model and client context to tailor responses across requests.Source: §3.2 · p. 7
- For dynamic inference replies, Ollure combines a dictionary of common prompts with regex handling for repetition requests and basic mathematical expressions.These responses draw on initial observations and can be extended; the authors note that evolving inference requests may require more advanced generation or a lightweight backend LLM.Source: §3.2 · pp. 7–8
4 Passive Measurement
This section documents activity across four deployments, spanning discovery and probing as well as attacks on infrastructure and LLM interfaces, including prompt-based extraction, safety-control bypass attempts, resource exhaustion, and agent-tool misuse; it also describes how Ollure’s isolated, limited-interaction design constrained what could be observed and exploited.
4.1 Experimental Setup
- Across four cloud and university instances, 84 days of deployment yielded 290,887 interactions from 2,793 unique source IP addresses.The DigitalOcean instances were located in Frankfurt, Germany.Source: §4.1 · p. 8
4.2 IP Analysis
- 65.38% of IPs probed only one instance and 8.27% all four; LIH drew more high-volume retries, while MIH had a higher return rate (68.63% vs. 62.59%).Repeat activity was concentrated within about a week on average, though some sources probed nearly the entire deployment.Source: §4.2 · pp. 8–9
4.3 Endpoint Interactions
- 79.36% of recorded interactions targeted model- and service-information endpoints, showing clear interest in discovering LLM APIs and model information; root (/) received 3,429 hits from 1,072 unique IPs.Source: §4.3 · p. 10
- 3,983 model-management modification attempts included 3,832 downloads from 45 IPs; payloads also probed permissions, used traversal paths or URLs, and attempted prompt injection.The analysis identified 2,232 probing or testing interactions, 29 attempts to reuse official model names, and 27 begware-related prompt requests; some paths pointed to credentials or local sensitive files.Source: §4.3 · pp. 11–13
- 56,063 inference interactions targeted /api/generate, /api/chat, and /api/embed, with /api/generate responsible for 94.53%; /api/embed saw only 228 requests in three diagnostic patterns.Most inference requests used legitimate model names; generate and chat prompts also included simple task probes, while chat requests tested conversational retention and assistant priming.Source: §4.3 · pp. 13–15
- Prompt activity sought model, system, and runtime information; attackers also used system prompts to impersonate high-capability models and chat tools including read_file and write_file.The study recorded 19 toxic guardrail-testing prompts, 144 conversational-retention checks, and 8 extended persona-priming prompts.Source: §4.3 · pp. 14–15
4.4 Attack Observations
- Observed infrastructure attacks included path traversal for file enumeration, SSRF for reconnaissance and credential access, malicious-model supply-chain attempts, and model-creation payloads for RCE and XMRig mining.Attackers also spoofed legitimate model names, apparently to test access controls or deceive users into interacting with compromised artifacts.Source: §4.4 · p. 16
- LLM-layer attacks included acquiring abliterated models and manipulating generation controls or flooding inputs to consume resources and induce inference-level denial of service.Examples included extreme context-window values, infinite token prediction, and 12,288 repetitions of “test”; prompt-level manipulation also treated the prompt space as an execution environment.Source: §4.4 · p. 18
- Attackers attempted to hijack instructions to disclose model and system details, and used targeted inference to reconstruct prior dialogue and expose sensitive session history.The targeted queries exploited a shared context window to harvest historical interaction data and maintain unauthorized session visibility.Source: §4.4 · p. 19
- Attackers used multilingual overrides and role-playing injections, including the Drakonchik persona, to evade safety filters and promote recruitment propaganda.The persona framing sought to manipulate semantic context and bypass guardrails through social engineering.Source: §4.4 · p. 19
- Role-playing prompt injections were combined with malicious tool-parameter use to trigger network probes and sensitive file read, write, or execute operations.Observed tools included network utilities such as get_time or ping, as well as web search.Source: §4.4 · pp. 19–20
- Ollure captured all Tamuka et al. high-level attack categories and nine of ten OWASP Top 10 LLM categories, but not several constrained vectors.Training-pipeline threats, including data poisoning and model inversion, as well as indirect prompt injection and AI-proxy attacks, were not observed; the isolated design constrained privilege escalation and lateral movement, and the honeypot did not support advanced exploitation.Source: §4.4 · p. 20
5 Conclusion
Ollure emulated the unauthenticated Ollama API across four deployments, recording substantial activity that included both automated reconnaissance and concrete exploitation attempts. Its release and interaction dataset support further measurement of threats to self-hosted LLM infrastructure.
5 Conclusion
- Across 84 days on four instances, Ollure recorded 290,887 interactions from 2,793 unique source IP addresses.Ollure is a low- and medium-interaction honeypot that emulates the unauthenticated Ollama API.Source: §5 · p. 20
- Most activity was automated reconnaissance, fingerprinting, and model enumeration, but concrete exploitation attempts targeted both infrastructure and LLM layers.Attempts included model-management abuse, path traversal and SSRF probes, RCE and cryptocurrency-mining payloads, resource exhaustion, prompt injection, information extraction, and agent-oriented tool use.Source: §5 · p. 20
- Releasing Ollure and its pseudo-anonymized interaction dataset provides a basis for further threat measurement; future work will extend framework and agentic-architecture coverage and evaluate longer deployments across more diverse networks.Source: §5 · p. 20
A Appendix · A.1 Ethical Considerations & Open Science
Ollure was deployed as a passive, privacy-conscious honeypot under accepted cyber-deception practices, and its code and pseudo-anonymized interaction dataset were released to support reproducibility.
A.1 Ethical Considerations & Open Science
- The university permitted Ollure’s deployment, which followed common practices for cyber-deception research.The honeypot was hosted on the university network.Source: §A.1 · pp. 22–23
- Ollure was standalone, had no production value or sensitive assets, and was never advertised or exposed to legitimate users.These safeguards limited the risk of affecting legitimate services or users.Source: §A.1 · p. 23
- As a passive observation point, Ollure generated no unprompted outbound traffic and conducted no active retaliatory scans.Source IP addresses were pseudo-anonymized before public distribution of the dataset.Source: §A.1 · p. 23
- The team publicly released the complete Ollure codebase on GitHub to support reproducible research.The paper also states that relevant artifacts were made publicly available in line with open science principles.Source: §A.1 · p. 23
- The team released a pseudo-anonymized dataset of captured API interactions and payloads on Zenodo.Source IP addresses were obscured before public distribution.Source: §A.1 · p. 23
A.2 Reoccurring IPs for Deployment
The section presents boxplots of recurring IP-instance interactions and request timing across Digital Ocean and university deployments.
A.2 Reoccurring IPs for Deployment
- Figures 6 and 7 show boxplots comparing recurring IP-instance combinations across Digital Ocean and university locations by total interactions, mean inter-request gap, and overall duration.Source: §A.2 · p. 23, Figure 6 · p. 23, Figure 7 · p. 24